How to comply with Saudi Arabia's PDPL: video walkthrough

Saudi Arabia's general personal data law

The Personal Data Protection Law is Saudi Arabia's general law on personal data. It governs processing of personal data in the Kingdom by any means, and reaches organisations abroad that process personal data relating to its residents. It gives individuals rights over their data, makes consent the starting point, and requires controllers to publish a privacy policy, secure data, report breaches, assess the impact of processing, keep a record of processing activities and send data abroad only on defined terms.

The Saudi Data and Artificial Intelligence Authority, SDAIA, supervises and enforces the Law and runs the National Data Governance Platform, where controllers register and notify breaches. Registration produces a registration certificate, which records registration, not compliance; no certificate of compliance is issued under the Law. This short film walks through how a programme is built.

Build it, run it, then demonstrate it

Settle what the programme has to cover: the entities in and outside the Kingdom, the organisation's role as controller or processor for each activity, any sector regulators, whether registration and a data protection officer are required, and who will judge the result. A gap analysis then compares current practice with the Law and SDAIA's Implementing Regulation and Transfer Regulation.

Implementation records each processing activity with its purpose and legal basis, obtains consent where the Law requires it and documents the cases where another basis applies, publishes the privacy policy, and sets up a request procedure with identity checks and a log that keeps deadlines visible, so individuals can be informed, access their data, obtain it in a readable form, have it corrected and have it destroyed once it is no longer needed. Security controls, breach notification through the platform, impact assessments, processor contracts and safeguards for transfers outside the Kingdom complete the programme. The record of processing activities is kept ready for inspection. SDAIA and clients' auditors judge whether the programme is enough.

Sterling's expert and experienced consultants design and implement the programme with your team under Sterling OS™. The Law has been in force since 14 September 2023, and its one-year adjustment period ended on 14 September 2024; legal interpretation stays with your legal advisers.